F:\Codes\CommonPlatform\Helper2345\bin\Win32\Release\pdb\Helper_2345.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bf6febc17d85399ef3aae661f270a5b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
bf6febc17d85399ef3aae661f270a5b0_NeikiAnalytics.exe
-
Size
1.2MB
-
MD5
bf6febc17d85399ef3aae661f270a5b0
-
SHA1
c34dec4c146ac6c46b8321f0d462f078eb7b6d58
-
SHA256
46817fbdc4651217797a64a2e55676cdb7ae093045a8f0329e7bf2869e746cf0
-
SHA512
a0ea4fd17394f78ddef68459b5d7d4902eead44e65b34af7482a072631c1b4893d9570c18ca2bc05c3715acd07bb1c7c9a8da8568858bb824be42460b7b3c492
-
SSDEEP
24576:PII2mRVMuLi/mDnICLJ4gxqBeU7/ATDNoo3cK0Ef2gsOaf:ymRV247qBeU7/ATDNo2+Ef2gsOaf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bf6febc17d85399ef3aae661f270a5b0_NeikiAnalytics.exe
Files
-
bf6febc17d85399ef3aae661f270a5b0_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
c6e8bd2e433bc48b6b25f594a9b816b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryW
GetModuleFileNameW
GetProcAddress
LocalFree
CreateProcessW
lstrcmpiW
CloseHandle
GetCurrentProcessId
FindFirstFileW
FileTimeToSystemTime
FindClose
GetModuleHandleW
GetFileAttributesW
ExpandEnvironmentStringsW
CreateMutexW
WaitForSingleObject
Sleep
GetLastError
ReleaseMutex
CreateFileW
GetLongPathNameW
GetFileAttributesExW
HeapAlloc
HeapFree
GetProcessHeap
OpenProcess
GetVersionExW
GetComputerNameExW
GetCurrentThreadId
GetCurrentProcess
QueryDosDeviceW
GetFileSize
SetFilePointer
SetEndOfFile
SetFileTime
WriteFile
ReadFile
GetFileTime
WideCharToMultiByte
GetACP
MultiByteToWideChar
FindNextFileW
FreeLibrary
FindResourceW
LoadResource
LockResource
GetSystemInfo
DeleteFileW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
GetFileSizeEx
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
RemoveDirectoryW
GetWindowsDirectoryW
SetFileAttributesW
GetLogicalDriveStringsW
SetEnvironmentVariableA
GetEnvironmentVariableW
SetEvent
GetTickCount
WaitForMultipleObjects
GetExitCodeProcess
FormatMessageW
GlobalMemoryStatusEx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ResumeThread
ResetEvent
CreateEventW
RaiseException
DecodePointer
InterlockedExchangeAdd
InterlockedExchange
SetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
GetCommandLineW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
EncodePointer
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
CommandLineToArgvW
Sections
.text Size: 903KB - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE